netdev - Re: [PATCH] Use unsigned variables for packet lengths in ip[6]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <4DEE4199.3090300@trash.net>
Date:	Tue, 07 Jun 2011 17:19:53 +0200
From:	Patrick McHardy <kaber@...sh.net>
To:	Dave Jones <davej@...hat.com>
CC:	David Miller <davem@...emloft.net>, netdev@...r.kernel.org,
	netfilter-devel@...r.kernel.org, pablo@...filter.org
Subject: Re: [PATCH] Use unsigned variables for packet lengths in ip[6]_queue.

On 07.06.2011 16:39, Dave Jones wrote:
> On Tue, Jun 07, 2011 at 04:19:08PM +0200, Patrick McHardy wrote:
>  
>  > >>> With the patch below, I haven't been able to reproduce the problem, but
>  > >>> I don't know if I've inadvertantly broken some other behaviour somewhere
>  > >>> deeper in netlink where this is valid.
>  > > 
>  > > This is fine, but I'm wondering whether this can really fix the problem
>  > > you've been seeing. Before the packet is reallocated, the length of
>  > > nlmsglen - NLMSGLEN(0) - sizeof(struct ipq_peer_msg) is compared to
>  > > ipq_peer_msg->data_len, so both values need to be wrong.
>  > > ipq_peer_msg->data_len is a size_t, so it's unsigned.
>  > > 
>  > > I think what we should additionally do is verify that data_len < 65535
>  > > since that's the maximum size of an IP packet.
>  > 
>  > We're actually already doing this. This makes it even more strange that
>  > you're seeing this problem. Could you send me your testcase?
> 
> I don't have a standalone test-case, just a generic fuzzing tool that passes
> sockets to various syscalls.  You can clone it from git://git.codemonkey.org.uk/trinity.git/
> (the test-random.sh should explain how to use it)

Thanks, that explains the weird values. Still wondering how it managed
to get passed the ipq_peer_msg length check.

Anyways, I'll give it a try myself.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html